krakend[.]pro

PhishDestroy identifies krakend.pro as an active crypto-draining domain designed to impersonate the legitimate Kraken cryptocurrency exchange. The site masquerades as a Kraken-branded landing page and is engineered to harvest private wallet keys or seed phrases, redirecting stolen funds to attacker-controlled addresses. Current telemetry indicates this asset is part of a broader campaign targeting users searching for Kraken services or promotions. No publicly documented drainer kit hash or full payload is yet available, though the domain’s rapid deployment and SSL certificate acquisition suggest a semi-automated, kit-based operation.

Forensic indicators are definitive: the domain was created on April 17, 2024, operates on IP 188.114.97.3, and is registered through NameCheap, Inc. VirusTotal currently shows 0/95 AV detections (0 % detection rate) as of the latest scan. The SSL certificate is issued by Google Trust Services, indicating an attempt to appear trustworthy, and the domain remains unflagged by Google Safe Browsing. No third-party blocklists have yet blacklisted this IP or domain, leaving users without upstream protection.

This investigation is currently under active review with status marked as active. PhishDestroy has escalated the domain to our threat intelligence pipeline and is collaborating with exchange partners and hosting providers to initiate takedown procedures. Remaining risk is assessed as HIGH due to the absence of detection coverage, the use of a fresh domain, and the clear intent to deceive through brand exploitation. Users are strongly advised to verify any Kraken-related links using PhishDestroy’s real-time verification tool before entering credentials or connecting wallets.